DynaPictures vs Photoroom API

DynaPictures 26

One API key per user with the user's full access, not limited to workspaces or actions; a new key is requested by email to support, with no rotation in the account (10 of 30). No read-only mode, and the MCP server can author and change designs (3 of 20). Tools return the account's own templates and renders; image layers accept outside URLs (10 of 15). A list of generated images, with no audit log documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 10 + 3 + 10 + 3 + 0 = 26.

Photoroom API 49

Per the 9 October check, not re-read on 4 November. A team can hold several API keys and revoke each in the dashboard, with no scopes found. The key travels in the x-api-key header only. The hosted MCP server's published OAuth metadata gives an authorisation code grant with PKCE, dynamic client registration and a revocation endpoint, per the 9 October reading, and the connector page says it creates its own key for the connection (20). No read-only key. The API stores nothing to change, a sandbox key cannot spend, and a prepaid monthly allowance bounds spend (8). Returns images, not untrusted text (10). The dashboard shows usage history, GET /v2/account returns the balance, and the security page says API access logs are kept for one year on Photoroom's side (6). The security page states a SOC 2 Type 2 attestation scoped to the API with a report of April 2026, held in a trust centre drawn by script that was not read. security.txt returns 404 and no disclosure policy or bug bounty was found, so a SOC 2 claim with no readable report or disclosure route (5).

DynaPictures 45

The MCP tool definitions weren't read (listing them needs a session), and llms.txt describes groups that include layer-by-layer design authoring, so the count is unknown. REST responses are small objects with image URLs (12 of 25). Template and generated-image listings, with no field selection documented (10 of 20). Errors are JSON with a message and documented statuses, without codes (12 of 20). Requests aren't idempotent, by the vendor's own note, though identical image URLs are served from cache without a credit (6 of 20). An Editor SDK for embedding the editor, and no API client SDKs (5 of 15). 12 + 10 + 12 + 6 + 5 = 45.

Photoroom API 64

Per the 9 October check, not re-read on 4 November. The response body is the image itself, so an agent saves a file and reads nothing into context. outputSize, maxWidth, maxHeight, export.format and the size presets set what comes back, and the MCP server has one tool, per Photoroom (18). Nothing to paginate. Output size, format and DPI controls (15). JSON errors with a message and a documented meaning for 400, 401, 403, 402, 429 and 500, but the two APIs use different shapes and Unauthorized covers both a missing key and an empty balance (13). No idempotency key. Calls keep no state, failed calls are not billed and background.seed repeats a generated background, but a retried success is billed again. The MCP tool's annotations were not read (10). Only the image is required and defaults are sensible. No official SDK, only sample code for four platforms (8).

DynaPictures 30

No x402, MPP or L402 (0). Image allowances per plan and AI credit packs ($20 for 1,000 credits) are public, but plan prices are filled in by the FastSpring script and weren't readable (10 of 20). Free plan and a 14-day trial with 30 API credits, no card (20). auth.md says a person has to copy the key; there is no OAuth or programmatic key (0). 0 + 10 + 20 + 0 = 30.

Photoroom API 40

Per the 9 October check, not re-read on 4 November. No x402, MPP or L402 in the docs, the OpenAPI description or the pricing pages (0). Per-image prices are public, $0.02 for background removal and $0.10 for an Image Editing call (20). Sandbox mode gives 1,000 free watermarked calls a month and a new account 10 free production calls on the Remove Background API, with no card, per the pricing page (20). A person has to create an account and activate the API in the dashboard. The MCP server also needs a Photoroom sign-in (0).

DynaPictures 4

No changelog, release notes or dated API change was found, and the MCP server card gives version 1.0.0 with no date (0). No dated changes since 8 August (0). Support by email and contact form, not tested (4 of 15). Not in the official MCP registry and no API SDKs (0). No public package or repository (0). 0 + 0 + 4 + 0 + 0 = 4.

Photoroom API 13

The last dated changelog entry is 21 April 2026 by the 9 October reading, 197 days before 4 November. The changelog sits on a paused host and was not re-read (0, cause time). No dated changelog entry in the 90 days from 6 August by that reading, and no other dated Photoroom source was found (0). A public changelog and a Discourse community where each of the 17 topics dated 30 September to 3 October 2026 had a reply, per the 9 October check. We did not open the topics to see who replied (11). No official SDK, and the official MCP registry search for photoroom returned no entry on 4 November (0). The sample code repository's last commit is a README change on 23 April 2026 and it has no CI, per a clone on 4 November (2).

DynaPictures 63

Closed service under terms (revision 2/2026) from DynaPictures GmbH in Freiburg, for business customers (15). The privacy policy names the controller, keeps generated images as long as needed or until deleted, gives plan image retention (3 months on Lite), and says the named AI providers don't train on API inputs under their API terms; other periods follow bookkeeping law (20 of 30). The OpenAPI file commits to six months' notice before removing an endpoint or field, with Deprecation and Sunset headers (16 of 20). AI sub-processors named with addresses (OpenAI, Google, Black Forest Labs, Replicate) and FastSpring for payments, while hosting providers aren't named (12 of 20). 15 + 20 + 16 + 12 = 63.

Photoroom API 69

Per the 9 October check, not re-read on 4 November. Closed hosted service under the Photoroom Terms and Conditions effective 29 July 2026, which name the application programming interface. Sample code is MIT (15). The security page gives retention figures (images discarded after the call, operational logs 15 days, API access logs one year). The statements on training disagree. The privacy policy of March 2026 says model improvement does not apply to API images, the security page says self-serve API plans train by default with an opt-out, and the terms authorise training on user content with an opt-out. A DPA is for Enterprise customers only (14). Preview and alpha functions carry a two-week notice, the 2024 base URL change gave a dated deadline, and the AI Backgrounds v2 model is marked deprecated with no removal date (12). The security page names GCP, AWS, Cloudflare, Datadog and Vercel and says hosting is in the United States. The full list is in the trust centre, which was not read (16).